Despite the fact that it’s registered and paid for until 2040.

I can believe that Verisign might have some route to terminate service (even in cases where there is some contractual obligation to provide a service for a given period of time, someone can typically break the contract, just having to pay some sort of penalty for doing so), but I also suspect that they are legally required to issue you some sort of refund.

You generally cannot just sell someone a service and then refuse to provide it; that’ll violate consumer protection laws.

That probably won’t make the author happy—he probably wants the domain, not the money. But at the minimum, I will say that he probably doesn’t have to pay for service that he doesn’t get.

It might be that they are doing that; he doesn’t specify.

But it gets much worse. Once the 3rd-level domains are terminated, it is assumed that the now vacant 2nd-level domains will become available for registration. Should someone (other than me) scoop up fraser.name they would be able to recreate and control neil.fraser.name. They’d be able to hijack hundreds of accounts that are linked to that address. They could commit code with my authentication. They could seize control of IoT devices. There is no way to enumerate all accounts (online and offline) which have been opened using this email address over the past quarter century.

Yeah, personally I’d rather have some kind of key-based mechanism, at least as an alternative to the X.509-based system. Think of what PGP or SSH do. Like, the key is your identifier, not the endorsement of some centralized registrar.

Hyphanet does something like this, can do key-based addresses.

That has some drawbacks too—I mean, you are the ultimate authority here, and thus responsible for keeping that key safe, and that’s a big responsibility. If you think of all the attacks on cryptocoin wallets and stuff, I think that personal computers are not incredibly-well-suited for that—if we’re going to do that, we probably want something more like hardware-based keystores, like YubiKeys or similar, where a key cannot be exfiltrated if a PC is compromised, as PCs have a big attack surface. And it’s harder for humans to remember a key as an identifier, which means that they probably have to have a computer somewhere store a list of known and trusted keys (though doing so solves a lot of existing attacks, like phishing emails with look-alike URLs that attack the limited human ability to remember names, so there are pros and cons). And it avoids the risk that someone with access to a certificate authority’s key can compromise your security.